Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N N A N N H 4.0 .0010 1.2 —
AFFECTED Product Versions Fixed HDF5 <= 2.1.1 – —
TIMELINE Jul 27 EXPLOIT PUBLISHED — CVE-2026-17573 (The HDF Group HDF5). Public exploit reference added. Jul 27 Reserved by HDFG Jul 27 Published (CNA: HDFG)
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.
| Date | Event | Detail |
|---|---|---|
| July 27, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-17573 (The HDF Group HDF5). Public exploit reference added. |
| July 27, 2026 | Reserved | Reserved by HDFG |
| July 27, 2026 | Published | Published (CNA: HDFG) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| The HDF Group | HDF5 | — | <= 2.1.1 | — |
Authoritative record: CVE-2026-17573 at cve.org
Vendors: the hdf group
Weaknesses: CWE-415
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-17573 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.